Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,695 detections
Filters
Last updated
All Time
Detection languages
2,745
1,501
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,668
71
52
31
29
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
2,448
1,976
1,634
1,401
856
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Detects when an internet hosted webdav share is mounted using the "net.exe" utility
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Identifies the creation of local users via the net.exe command.
Detects the execution of netsh with the "trace" flag in order to start a network capture
Detect the harvesting of wifi credentials using netsh.exe
Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.
Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)
Detect use of PDQ Deploy remote admin tool
Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on a remote machines
Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.
Execution of plink to perform data exfiltration and tunneling
Detects audio capture via PowerShell Cmdlet.
Detects base64 encoded strings used in hidden malicious PowerShell command lines
Detects attempts of decoding encoded Gzip archives via PowerShell.
Detects email exfiltration via powershell cmdlets
Detects a suspicious or uncommon parent processes of PowerShell
Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques
Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks.
Detects the use of 3proxy, a tiny free proxy server
Detects the use of Ditsnap tool, an inspection tool for Active Directory database, ntds.dit.
Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network
Page 314 of 319